Yksityisyyden suoja ja henkilöarviointi

Abstract

Tietotekniikan nopea kehittyminen on mahdollistanut yksilön henkilötietojen keräämisen aivan eri tavoin kuin esimerkiksi parikymmentä vuotta sitten. Yksilön suojaksi tarkoitettu tietosuojalainsäädäntömme perustuu ihmisoikeussopimuksiin, EU:n tietosuojadirektiiviin ja perustuslain perusoikeussäännöksiin. Suomen työelämää koskeva tietosuojalaki on edelleen ainoa erityisesti työelämää koskeva erillislaki EU:n alueella.

Yksityisyyden suojan keskeisiä lähtökohtia on oikeus tietää ja päättää itseään koskevien tietojen käytöstä. Yksityisyyden suojaa säädellään Suomen lainsäädännössä varsin laajasti lähtien perusoikeussäännöksistä päätyen aina uuteen työelämän tietosuojalakiin. Lainsäädännön tavoitteena on yksityisen henkilön suojeleminen varsinkin syrjinnältä asiattomin perustein. Arkaluonteisten tietojen käytön kieltäminen on keskeinen tasa-arvon elementti pyrittäessä estämään henkilötietojen käytön muodostumista syrjinnän välineeksi.

Lainsäädännön henkilötietojen keräämiselle ja käsittelylle säätämät laadulliset vaateet ovat aiheuttaneet tulkintaongelmia ja ovat myös tietyllä tavalla ristiriitaisia. Tietojen tarpeellisuusvaatimuksella on haluttu rajoittaa ja jopa suorastaan minimoida käsiteltäviä henkilötietoja. Työnantajalla on oikeus käsitellä vain työntekijän työsuhteen kannalta välittömästi tarpeellisia tietoja. Tietojen tarpeellisuusvaatimus saattaa jopa kärjistää perinteisiä työelämän jännitteitä. Työnantajan edun mukaista on tietää oleelliset asiat työnhakijasta ennen lopullista valintapäätöstä - myös mahdolliset negatiiviset seikat ovat tärkeitä päättäjälle. Työnhakijalla on puolestaan tarve säilyttää oma yksityisyytensä ja luultavasti myös salata itselleen epäedullisia tietoja.

Toinen tulkintaa vaatinut laadullinen vaade eli tietojen virheettömyysvaatimus korostuu työelämän tietosuojalain säädöksissä,joissa työnantajalle on sälytetty vastuu käyttämiensä testien luotettavuudesta, testien suorittajien asiantuntemuksesta ja testien tulosten virheettömyydestä. Henkilövalintojen päätösten taustalla on usein monia testejä ja tietoja eri lähteistä. Henkilöarvioinnissa tiedot yhdistetään ja analysoidaan. Henkilöarviointi on varsin vaativa prosessi, jossa virheiden mahdollisuus on suuri. Käytännössä virheettömyyden saavuttaminen on hyvin vaikeaa, vaikka laissa päätökselle onkin lähtökohtaisesti asetettu täydellisyysvaatimus. Testaajille ei ole lainsäädännössä säädetty pätevyysvaatimuksia, vaan työnantaja on vastuussa soveltuvuuden arvioinnin laadukkuudesta eli tässä tapauksessa virheettömyydestä.

Suomessa käytetään henkilöarvioinnin osana paljon erilaisia testejä. Niiden runsas käyttö saattaa kuvastaa muutosta perinteisestä pätevyyden arvioinnista hakijan moninaisten ominaisuuksien arviointiin. Lisääntyvä käyttö kuvastanee myös epärealistisia odotuksia. Testien avulla työnantajat odottavat aina löytävänsä sopivimman hakijan, joka myös menestyy tehtävässään. Koska testaajien ammattitaito on oleellinen osa luotettavaa henkilöarviointia, Suomen Psykologiliitto on ryhtynyt myöntämään laatusertifikaatteja osaaville testaajille. Voidaan tietysti kysyä, onko tämä riittävä toimenpide henkilöarviointien ja testausten luotettavuuden lisäämiseksi. Pysyvämpiin tuloksiin voitaisiin päästä liittämällä soveltuvuuden arviointi ja rekrytoinnin päätöksentekoprosessi osaksi yrityksen laatujärjestelmää.

Protection of privacy and personal assessment

The enormous progress achieved in information technology has made it possible to collect personal data on individuals in a manner quite different from twenty years ago. Our legislation on data protection intended to protect the individual is based on human rights agreements, the EU Directive on the protection of individuals with regard to the processing of personal data and on the free movement of such data and the basic rights provided for in the Constitution. In the EU area the legislation on data protection is being harmonised; as France passed her own legislation on data protection in 2004. The Data Protection Act concerning working life in Finland continues to be the only special law in force in the EU with special reference to working life. The current conception is that no corresponding special legislation is being created elsewhere in the EU.

It was the main aim of the study to ascertain how privacy is protected in law, especially in connection with personal assessment. The target group selected was enterprises in the private sector. The regulation is actually fairly extensive ­ from the provisions for basic rights to the new Data Protection Act for working life. The legislation aims to protect the private individual especially against discrimination on inappropriate grounds. Forbidding the use of sensitive material is a core element of equality in the drive to prevent the collection of personal data from becoming a tool for discrimination. Data protection monitoring information by the EU suggests that people are most concerned about the misuse and publication of information on their economic and health status.

The legislation on the protection of data in working life introduced a new way of thinking about the protection of privacy. According to the legal provisions, an employer using personal and applicability tests to test an employee should ensure that the testing is with reliable testing methods, that those implementing them possess the appropriate expertise and that the information yielded by the tests is flawless. In the legislation the point of departure is that protection of privacy should prevail in the testing of individuals if the qualifications described in the rules are indeed realised.

The demands placed by the legislation on the collection and handling of personal data are in a way contradictory. On the one hand there has been a desire with the necessity requirement to limit and indeed to minimize the personal data to be processed. The right of the employer to process only those personal details indispensable with regard to the employment relationship is noted as a central and compelling legal norm from the perspective of working life. The necessity requirement also extends to the recruitment situation and the various tests. The necessity requirement of data may exacerbate traditional tensions in working life. It is in the interests of the employer to be aware of the most essential matters pertaining to the applicant before a final decision is made ­ possible negative aspects may be important to the decision-maker. The jobseeker on the other hand needs to preserve his/her own privacy and possibly also to conceal disadvantageous information regarding him/herself.

In addition to the requirement for necessary information the legislation also stipulates an important qualitative requirement, namely that the data collected on the individual be flawless. This requirement is linked particularly to personal and suitability assessments. The selection of individuals and the various assessment methods is a demanding and complicated process in which the risk of errors is great.The selection of an individual is always based on several different types and sources of information, whose combination and use these should be objective even when scientifically assessed. In practice it is very difficult. One aim of the Act on Data Protection in working life is to reduce the use of unreliable suitability tests. This aim is pursued through regulations according to which, when testing a (prospective) employee, the employer must use reliable testing methods and otherwise ensure the flawlessness of the information derived from the testing. However, no competence requirements for testers are stipulated in the legislation; the responsibility for the good quality of the suitability assessment, in this case perfection, rests with the employer.

In Finland many different tests are used as part of personal assessment. Their application, extensive by international standards, may well reflect unrealistic expectations. In interpreting the flawlessness requirement, an assumption of reliability is attached to the tests according to which testing always makes it possible to find the most suitable applicant, who will also do well in the job. In an effort to introduce a multi-disciplinary element into the research, the reliability of the most common personal assessment methods was ascertained. Since the professional skill of the testers is an integral part of reliable personal assessment, the Finnish Psychological Association has introduced quality certification of competent testers. Of course, one may ask if this is a sufficient measure to increase the reliability of personal assessment and testing. Better and more lasting results might be achieved by making the assessment and recruitment decision-making process a part of the company s quality assurance system. This would ensure that personal assessment would be carried out at a sufficiently high quality level from the perspective of the company s overall operations.

A questionnaire was used to ascertain the effects and functionality of our data protection legislation in working life. The responses indicate that the effects in enterprises were not very significant. Certain measures, guidelines and checks were indeed made. It could be gleaned from the responses of some consultancy firms that the interpretation of the necessity principle, considered so important in the legislation, was loose. Depending on the situation and the applicant it was a case of anything goes regarding the posing of questions. This is likely indicative of the present development from an assessment of competence to an assessment of all manner of applicants attributes. Those commissioning testing reported that the main reason for personal assessment was the opportunity to select the best applicant. The consultants for their part estimated that the greatest benefit to be derived from personal assessment was the elimination of risks in selecting a new person. It could be read in the responses of the individuals so assessed that there was a general satisfaction regarding the appropriateness of the assessment. On the other hand, applicants participating in assessment did not appear much concerned about the protection of their privacy regarding the tests. Understandably, the main interest was primarily in passing with a reasonably good score.

The future prospects for the development of the protection of privacy are contradictory. The European model, characterised by preventive legislation, has spread throughout the EU area. The situation and attitudes have changed since the events of 11 September 2001, especially in the USA. In the fight against terrorism surveillance has become the main modus operandi. The focus has shifted from dangerous individuals to people in general, and especially to airline passengers. In the practical measures for data protection it may be that the safety of the organisation has taken precedence over the protection of the individual. The EU data protection ombudsmen in autumn 2005 expressed their profound concern at the proliferation worldwide of risks to the privacy of the individual. It should also be noted that the protection of the economic interests of organisations would appear in the regulations on the protection of personal data to constitute a legitimate reason for deviating from the rights pertaining to the protection of personal data.